|    581  has been used to establish the correctness of some quite large |    581  has been used to establish the correctness of some quite large | 
|    582  programs (for example an <A HREF="http://ertos.nicta.com.au/research/l4.verified/">operating system</A>). |    582  programs (for example an <A HREF="http://ertos.nicta.com.au/research/l4.verified/">operating system</A>). | 
|    583  Together with colleagues from Nanjing, I used this theorem prover to establish the correctness of a |    583  Together with colleagues from Nanjing, I used this theorem prover to establish the correctness of a | 
|    584  scheduling algorithm, called |    584  scheduling algorithm, called | 
|    585  <A HREF="http://en.wikipedia.org/wiki/Priority_inheritance">Priority Inheritance</A>, |    585  <A HREF="http://en.wikipedia.org/wiki/Priority_inheritance">Priority Inheritance</A>, | 
|    586  for real time operating systems. This scheduling algorithm is part of the operating |    586  for real-time operating systems. This scheduling algorithm is part of the operating | 
|    587  system that drives, for example, the  |    587  system that drives, for example, the  | 
|    588  <A HREF="http://en.wikipedia.org/wiki/Mars_Exploration_Rover">Mars rovers</A>. |    588  <A HREF="http://en.wikipedia.org/wiki/Mars_Exploration_Rover">Mars rovers</A>. | 
|    589  Actually, the very first Mars rover mission in 1997 did not have this |    589  Actually, the very first Mars rover mission in 1997 did not have this | 
|    590  algorithm switched on and it almost caused a catastrophic mission failure (see |    590  algorithm switched on and it almost caused a catastrophic mission failure (see | 
|    591  this youtube video <A HREF="http://www.youtube.com/watch?v=lyx7kARrGeM">here</A> |    591  this youtube video <A HREF="http://www.youtube.com/watch?v=lyx7kARrGeM">here</A> |